diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 9c5347df7..2d7d2fd49 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -19,13 +19,13 @@ jobs: - name: Get all changed website files id: changed_website_files - uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 + uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5 with: files: website/** - name: Set up Node.js if: steps.changed_website_files.outputs.any_changed == 'true' - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: 24.x @@ -51,7 +51,7 @@ jobs: persist-credentials: false - name: Set up Node.js - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: 24.x @@ -62,4 +62,4 @@ jobs: corepack prepare yarn@stable --activate yarn install --immutable - - uses: j178/prek-action@79f765515bd648eb4d6bb1b17277b7cb22cb6468 # v2.0.0 + - uses: j178/prek-action@53276d8b0d10f8b6672aa85b4588c6921d0370cc # v2.0.1 diff --git a/.github/workflows/smoketest.yml b/.github/workflows/smoketest.yml index 024786ad7..52a48c125 100644 --- a/.github/workflows/smoketest.yml +++ b/.github/workflows/smoketest.yml @@ -18,10 +18,10 @@ jobs: persist-credentials: false - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - repository: eclipse/openvsx + repository: eclipse-openvsx/openvsx path: openvsx persist-credentials: false - - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 + - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: 18.x - name: Install dependencies @@ -52,7 +52,7 @@ jobs: if: steps.check_version.outputs.is_version == 'true' working-directory: ./openvsx/webui run: yarn smoke-tests - - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 if: steps.check_version.outputs.is_version == 'true' with: name: playwright-report diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index d566c67b6..9a9248750 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -19,7 +19,7 @@ jobs: persist-credentials: false fetch-depth: 0 - name: Cache SonarCloud packages - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: ~/.sonar/cache key: ${{ runner.os }}-sonar diff --git a/Dockerfile b/Dockerfile index c35ee2db1..bfccc1eac 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ -ARG SERVER_VERSION=v0.33.0 -ARG SERVER_VERSION_STRING=v0.33.0 +ARG SERVER_VERSION=rate-limiting-p2 +ARG SERVER_VERSION_STRING=v0.34.0-dev # Builder image to compile the website FROM ubuntu:24.04 AS builder @@ -27,7 +27,7 @@ RUN cd website \ && yarn build # Main image derived from openvsx-server -FROM ghcr.io/eclipse-openvsx/openvsx-server:${SERVER_VERSION} +FROM ghcr.io/eclipse-openvsx/openvsx-server-snapshot:${SERVER_VERSION} ARG SERVER_VERSION ARG SERVER_VERSION_STRING diff --git a/charts/openvsx/values-test.yaml b/charts/openvsx/values-test.yaml index 083e86e4c..d231a941d 100644 --- a/charts/openvsx/values-test.yaml +++ b/charts/openvsx/values-test.yaml @@ -103,3 +103,20 @@ clamav: yara: enabled: true + +postgresql: + enabled: true + architecture: standalone + + auth: + enablePostgresUser: true + + # The username to auto-create + username: "openvsx-test-rw" + + # The database to auto-create + database: "openvsx-test" + + # Reference to an existing secret containing the passwords. + # Expected keys: "password" (for the username above) and "postgres-password" (for the postgres admin user). + existingSecret: "postgresql-test-creds" diff --git a/configuration/application.yml b/configuration/application.yml index 29a1b6f80..728f92f27 100644 --- a/configuration/application.yml +++ b/configuration/application.yml @@ -6,7 +6,11 @@ logging: level: root: "info" + # avoid log messages like: Received invalid Accept header. Assuming all media types are accepted + org.springframework.boot.autoconfigure.web.servlet.WelcomePageHandlerMapping: "error" + io.lettuce.core.protocol: "warn" org.eclipse.openvsx.ratelimit: "debug" + org.eclipse.openvsx.scanning: "debug" server: address: 0.0.0.0 @@ -156,7 +160,8 @@ ovsx: seconds: 10800 once-per-version: true extension-control: - update-on-start: true + # do not update on application start as this would trigger multiple jobs in multi-pod configuration + update-on-start: false integrity: key-pair: create registry: @@ -195,17 +200,20 @@ ovsx: mail: from: no-reply@open-vsx.org - # tier-based rate limiting configuration + # dynamic tier-based rate limiting configuration rate-limit: enabled: true - ip-address-function: '(getHeader("X-Real-IP")?: getRemoteAddr()).trim()' + # on the trust boundary, "X-Real-IP" is set for any external requests + # for internal requests from within the cluster check first if "X-Forwarded-For" is set, otherwise use the remote addr. + # jetty seems to return "[127.0.0.1]" as remote addr in some cases, need to investigate why this is happening + ip-address-function: '(getHeader("X-Real-IP")?: getHeader("X-Forwarded-For")?: getRemoteAddr()).split(",")[0].trim()' usage-stats: - job-schedule: '*/30 * * * *' + job-schedule: '*/30 * * * * *' filters: - url: '/(api|vscode)/.*' http-response-headers: Access-Control-Allow-Origin: '*' - Access-Control-Expose-Headers: X-Rate-Limit-Retry-After-Seconds, X-Rate-Limit-Remaining + Access-Control-Expose-Headers: Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset default-http-content-type: application/json default-http-response-body: > { diff --git a/mail-templates/access-token-expired.html b/mail-templates/access-token-expired.html new file mode 100644 index 000000000..ea83a20dd --- /dev/null +++ b/mail-templates/access-token-expired.html @@ -0,0 +1,26 @@ + + + + + + +

Hi John Doe,

+

+ This is a notification that your Open VSX Personal Access Token Test token has expired as of 11/14/2025. +

+

+ For your security, this token has been deactivated and can no longer be used to authenticate or publish extensions to the Open VSX Registry. +

+

+ To restore access please log in to your Open VSX account, generate a new token, and update your previous integrations. +

+

+ If you need help or have any questions, feel free to contact us at openvsx@eclipse-foundation.org. +

+

+ Best,
+ Eclipse Foundation
+ The Open VSX Team +

+ + diff --git a/mail-templates/access-token-expiry-notification.html b/mail-templates/access-token-expiry-notification.html new file mode 100644 index 000000000..396e1b062 --- /dev/null +++ b/mail-templates/access-token-expiry-notification.html @@ -0,0 +1,23 @@ + + + + + + +

Hi John Doe,

+

+ This is a friendly reminder that your Open VSX Personal Access Token Test token will expire on 11/14/2025. +

+

+ To prevent any disruption to your publishing workflows, automated pipelines or API access, please log in to your Open VSX account to generate a new token before this date. Be sure to rotate the new token into your CI/CD environments (such as GitHub Actions or GitLab CI). +

+

+ If you have any questions or require assistance, please reach out to us at openvsx@eclipse-foundation.org. +

+

+ Best,
+ Eclipse Foundation
+ The Open VSX Team +

+ + diff --git a/mail-templates/revoked-access-tokens.html b/mail-templates/revoked-access-tokens.html new file mode 100644 index 000000000..dbe81d855 --- /dev/null +++ b/mail-templates/revoked-access-tokens.html @@ -0,0 +1,29 @@ + + + + + + +

Hello Contributor,

+ +

This is an automated notification to inform you that one or more of your Personal Access Tokens (PATs) for the Open VSX Registry have been revoked.

+ +

Tokens are typically revoked for the following reasons:

+ + +

Action Required:
+To prevent failed deployments or interruptions in your publishing pipelines, please log in and generate a new PAT via your Open VSX account settings. Remember to update your active pipelines with the new token.

+ +

If you believe this was a mistake or if you need assistance, please reach out to us at openvsx@eclipse-foundation.org.

+ +

+ Best,
+ Eclipse Foundation
+ The Open VSX Team +

+ + diff --git a/website/.gitignore b/website/.gitignore index 66253ecd4..edc7a33fb 100644 --- a/website/.gitignore +++ b/website/.gitignore @@ -12,3 +12,4 @@ node_modules/ /dev/static/bundle.* /dev/static/report-* yarn-error.log +stats.html diff --git a/website/configs/base.tsconfig.json b/website/configs/base.tsconfig.json index 022c715c5..b01da6bde 100644 --- a/website/configs/base.tsconfig.json +++ b/website/configs/base.tsconfig.json @@ -1,15 +1,11 @@ { "compilerOptions": { - "target": "es6", - "module": "es6", + "target": "es2020", + "module": "es2020", "moduleResolution": "bundler", "allowSyntheticDefaultImports": true, - "lib": [ - "es6", "es2020.string", "dom" - ], - "typeRoots": [ - "node_modules/@types", "typings" - ], + "lib": ["es2020", "dom"], + "typeRoots": ["node_modules/@types", "typings"], "sourceMap": true, "declaration": true, "declarationMap": true, diff --git a/website/eslint.config.mjs b/website/eslint.config.mjs index 2b5e97f8b..156ebb56d 100644 --- a/website/eslint.config.mjs +++ b/website/eslint.config.mjs @@ -24,7 +24,7 @@ export default [ 'plugin:react/recommended' ), { - files: ['**/*.ts', '**/*.tsx'], + files: ['**/*.ts', '**/*.tsx', '**/*.mts'], plugins: { '@typescript-eslint': typescriptEslint, '@stylistic': stylistic, @@ -45,6 +45,14 @@ export default [ '@typescript-eslint/ban-types': 'off', '@/brace-style': ['warn', '1tbs'], + // https://mui.com/material-ui/guides/minimizing-bundle-size/#enforce-best-practices-with-eslint + 'no-restricted-imports': [ + 'error', + { + 'patterns': [{ 'regex': '^@mui/[^/]+$' }] + } + ], + '@/comma-spacing': [ 'warn', { diff --git a/website/index.html b/website/index.html index 85fb5b2f0..0a36500b3 100644 --- a/website/index.html +++ b/website/index.html @@ -18,9 +18,9 @@ + href="https://www.eclipse.org/eclipse.org-common/themes/solstice/public/stylesheets/vendor/cookieconsent/cookieconsent.min.css" />